CVE-2026-65876

CriticalCVSS 9.2

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The SP Page Builder extension for Joomla versions below 6.7.1 contains an unauthenticated SQL injection vulnerability in the loadMoreArticles endpoint due to improper validation of the catid parameter.

Risk Assessment

An attacker could execute arbitrary SQL queries, potentially leading to data leakage or Joomla site takeover.

Recommendation

Update SP Page Builder to version 6.7.1 or later.

Original NVD description (English source)

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.